GHSA-frqx-jfcm-6jjr

Source

https://github.com/advisories/GHSA-frqx-jfcm-6jjr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-frqx-jfcm-6jjr/GHSA-frqx-jfcm-6jjr.json

Aliases

• CVE-2023-33199

Published

2023-05-26T19:39:03Z

Modified

2023-11-08T04:12:40.056905Z

Details

Impact

A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.

Patches

This is fixed in v1.2.0 of Rekor.

Workarounds

No

References

Discovered by OSS-Fuzz

References

• https://github.com/sigstore/rekor/security/advisories/GHSA-frqx-jfcm-6jjr
• https://nvd.nist.gov/vuln/detail/CVE-2023-33199
• https://github.com/sigstore/rekor/commit/140c5add105179e5ffd9e3e114fd1b6b93aebbd4
• https://github.com/sigstore/rekor